CVE-2026-91751: Flextype CMS Path Traversal Vulnerability

CVE-2026-91751 Overview

CVE-2026-91751 is a path traversal vulnerability [CWE-22] affecting Flextype CMS through version 1.0.0-alpha.3. The flaw resides in the Entries REST API, which fails to properly validate the id and new_id parameters. An authenticated attacker holding a valid API token can inject traversal sequences to escape the entries directory. This allows arbitrary read, create, or overwrite operations against files outside the intended project scope. The vulnerability affects the file handling logic in src/flextype/core/Entries/Entries.php.

Critical Impact
API token holders can read, create, or overwrite arbitrary files on the filesystem, enabling configuration tampering, code overwrite, and potential remote code execution through webshell placement.

Affected Products

Flextype CMS versions through 1.0.0-alpha.3
Entries REST API component (Entries.php)
Any deployment exposing the Flextype API to authenticated users

Discovery Timeline

2026-09-15 - CVE-2026-91751 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91751

Vulnerability Analysis

The vulnerability originates in the Entries REST API handlers responsible for creating, updating, and retrieving entry files. Flextype treats the id and new_id parameters as trusted path components when resolving files under the entries directory. Because the application does not canonicalize or sanitize these inputs, directory traversal sequences such as ../ remain intact when concatenated into filesystem paths.

An attacker with a valid API token can therefore issue requests referencing paths outside the project's entries root. The resulting file operations execute with the privileges of the PHP process, extending the impact beyond content management into arbitrary filesystem manipulation. See the VulnCheck Advisory on Flextype CMS for the full technical breakdown.

Root Cause

The root cause is missing input validation on user-controlled path segments in the Entries API. The affected logic in Entries.php lines 856-906 builds destination paths through direct string concatenation. The code neither enforces a base-directory prefix check nor rejects traversal metacharacters before touching the filesystem.

Attack Vector

Exploitation requires network access to the Flextype REST API and a valid API token with entry management permissions. The attacker submits API calls where the id or new_id field contains traversal sequences pointing at arbitrary filesystem locations. Successful requests allow the attacker to read sensitive configuration, overwrite existing PHP source files, or drop new files into web-accessible directories. Additional details are documented in GitHub Issue #596.

No verified public proof-of-concept code is available. Refer to the vendor repository for source-level context: GitHub Flextype Repository.

Detection Methods for CVE-2026-91751

Indicators of Compromise

HTTP requests to Flextype Entries API endpoints containing ../ or URL-encoded %2e%2e%2f sequences in the id or new_id parameters.
Unexpected file creation, modification, or access timestamps on files outside the project/entries/ directory.
New or modified PHP files in web-accessible directories that do not match deployment artifacts.
API access log entries showing entry operations targeting paths such as config, logs, or system directories.

Detection Strategies

Inspect web server and reverse proxy logs for Entries API calls containing traversal metacharacters or absolute path fragments.
Correlate authenticated API activity with filesystem change events using file integrity monitoring on the Flextype installation directory.
Alert on API token usage patterns that deviate from baseline entry operations, particularly bulk create or rename actions.

Monitoring Recommendations

Enable verbose access logging on the Flextype REST API with full request URI capture, including query and body parameters.
Deploy file integrity monitoring across the webroot, config/, and PHP source directories to detect unauthorized writes.
Forward web server, application, and file integrity telemetry to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2026-91751

Immediate Actions Required

Restrict network access to the Flextype REST API to trusted management networks until a patched release is deployed.
Rotate all issued API tokens and reduce token scope to the minimum required for each integration.
Audit the filesystem for unauthorized file creation or modification outside the entries directory.
Review recent API access logs for traversal patterns in id and new_id parameters.

Patch Information

At the time of publication, no fixed release has been identified in the enriched data. Monitor the GitHub Flextype Repository and GitHub Issue #596 for remediation status. Until a patched build is available, apply the workarounds below and treat the API as a privileged attack surface.

Workarounds

Place the Flextype application behind a web application firewall configured to block traversal sequences in API request parameters.
Enforce filesystem-level permissions so the PHP process cannot write outside the intended entries directory.
Disable or firewall the Entries REST API where it is not required for business operations.
Require additional authentication controls, such as network-layer allowlists, in front of API token authentication.

bash

# Example NGINX rule to block traversal sequences in Entries API requests
location ~* /api/.*entries {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
}